PSJailBreak Reverse Engineered, Requires Hardware to Update

A few days ago PSJailBreak Reverse-Engineering work began, and today German site GamerFreax.de (linked above) has posted a breakdown of the PSJailBreak, how it was reverse engineered and notes that it requires additional hardware to update.

Below is the rough translation of the PS JailBreak reverse-engineering details, to quote:

"We have the PSJailbreak dongle yet again brought out of retirement to put it more precisely Herbs to take a closer look. We tell you here in brief the main steps of the internal process of PSJailbreak.

We can confirm that it can not confirm that PSJailbreak a clone of Sony's "Jig" is module. PSJailbrak is an exploit honest self-developed. The chip is not but a PIC18F444 ATMega with software USB.

This means the chip is internally capable of USB to emulate. PSJailbreak mainly be emulated 6Port a USB hub connected to a specific end USB devices and then disconnected. One of these devices has the ID of Sony's "Jig" module, which means that played in the development of PSJailbreaks the "Jig" module, a certain role.

But let's start at the front: When the PS3 is clamped in the USB emulation device, which has a much too big Configuration Descriptor. This Descriptor überschriebt the stack with a PowerPC contained code that is executed. Now, various USB devices are connected in the emulation. A device has a large 0xAD Descriptor, which is part of the exploit and contains static data.

A short time later (we are moving here in Milisekundenbereich) the jig module is connected, and encrypted data are transmitted to the module jig. A (in Milisekundenbereich) eternity later, the answers Jig 64Byte module with static data, all USB devices are disconnected, a new USB device is connected and the PS3 launches with a new look.

64Byte static data that is emulated by the PS3 64Byte Jig sent to the static data that is emulated by Jig sent to the PS3

Extract from the USB stream Extract from the USB stream (pictured below).

Incidentally PSJailbreak is NOT updateable. The Update feature can be mentioned, if realized at all, only with additional hardware."

Interesting idea indeed as PSP has hardware that could be used to emulate the USB JIG. However unless you will have the JIG or at least dump of the communication on the USB bus you probably won't get far as the PS3 probably won't even communicate with PSP until it has correct IDs.

Do you want to emulate the dongle with an PC or are you the one who uses the psp to do this job.

A psp solution seems to be the most senseful as their is an "special" usb connection to the ps3 system innately.

So somebody with a dongle should use the tool you linked to provide the unknown data you need?!

Hopefully someone can manage to provide a free solution to the scene while the "still" overpriced clones pop out of the ground like mushrooms. Which is of course an indication on how low the original PSJailbreak security level is.

But with so much talented Devs in the scene it shouldnt take too long from now...

Are you looking at communicating from a PC to the PS3 using an RS232-to-USB adapter to accomplish this? I had a theory that sending the HW ID of the Jailbreak during bootup could send the PS3 into Service Mode.

EDIT: Didn't see your reply while I was typing mine, XSamurai. Good call, with the PSP idea.

With the amount of talent in the scene that we have currently working with the Jailbreaks, I'd give it a high probability that after full documentation regarding all hardware and software functions of the JB is released, we'd quickly see some sort of PSP homebrew that could be used to send the PS3 into Service Mode.

Another idea I had, which I think would be feasible with the right tooling, is modifying a standard PS3 Sixaxis to work as a Jailbreak when plugged into the USB. Any thoughts?

Are you looking at communicating from a PC to the PS3 using an RS232-to-USB adapter to accomplish this? I had a theory that sending the HW ID of the Jailbreak during bootup could send the PS3 into Service Mode.

EDIT: Didn't see your reply while I was typing mine, XSamurai. Good call, with the PSP idea.

With the amount of talent in the scene that we have currently working with the Jailbreaks, I'd give it a high probability that after full documentation regarding all hardware and software functions of the JB is released, we'd quickly see some sort of PSP homebrew that could be used to send the PS3 into Service Mode.

Another idea I had, which I think would be feasible with the right tooling, is modifying a standard PS3 Sixaxis to work as a Jailbreak when plugged into the USB. Any thoughts?

Interesting idea indeed as PSP has hardware that could be used to emulate the USB JIG. However unless you will have the JIG or at least dump of the communication on the USB bus you probably won't get far as the PS3 probably won't even communicate with PSP until it has correct IDs.

In fact, I started programming it on psp. They are two ways to emulate the dongle:

-We can sniff and logg informations
-The other way is a complet reverse of algo and dump.